Charming Kitten's HYPERSCRAPE Tool Found Stealing User Data from Email Accounts
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Compromised Credentials
- Attack Complexity: Low
- Threat Risk: Low Impact/Low Probability
Threat Overview
A new tool called HYPERSCRAPE, discovered by Google Threat Analysis Group in December 2021, has been found to be used by Charming Kitten to steal user data from Gmail, Yahoo and Microsoft Outlook accounts. HYPERSCRAPE requires the victim's account credentials to run, and once logged in, it changes the account's language settings to English, downloads messages individually as .eml files, and reverts the language back to its original settings once the inbox has been downloaded.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Region | Iran | Verified |
Extracted IOCs
- 03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369
- 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23
- 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208
- 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798
- 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f
- 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4
- 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f
- ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6
- cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa
- 136[.]243.108.14
- 173[.]209.51.54
Tip: 11 related IOCs (2 IP, 0 domain, 0 URL, 0 email, 9 file hash) to this threat have been found.
About Affiliation
Charming Kitten
Charming Kitten is an Iranian state-sponsored threat actor linked to the Islamic Revolutionary Guard Corps (IRGC) and active since at least 2012. The group conducts cyber espionage operations primarily targeting journalists, academics, political dissidents, think tank researchers, activists, and government officials across the Middle East, Europe, and the United States. Charming Kitten is best known for sustained credential phishing campaigns using fake login pages and social engineering, alongside the exploitation of known vulnerabilities in enterprise software. The cluster is tracked under numerous aliases across the industry including APT35, Magic Hound, Mint Sandstorm, and Phosphorus.
View Charming Kitten's Insights